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DETAILED ACTION 

1. This office action is in response to application filed on May 15, 2001. Claims 1-24 are 
considered for examination. 

Claim Rejections - 35 USC § 103 

2. Following is a quotation of 35 U.S.C. 103(a) which forms the basis for all obviousness 
rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 

3. Claims 1-24 are rejected under 35 U.S.C. 102(e) as anticipated by or, in the alternative, under 
35 U.S.C. 103(a) as obvious over Bullard (U.S. Pat. No. 6,625,657, hereinafter Bullard). 

Per claims 1 and 1 1 , Bullard teaches a method for profiling network flows at a measurement 
point within a computer network (system of Bullard, Abstract, receive network flow information 
from the network entities and to produce records based on the information, and col. 3, lines 27- 
36, The accounting process 14, as will be described in FIG. 2, has a core process that can handle 
profiling ), the method comprising: 

measuring network flows at a measurement point located within routing infrastructure of the 
computer network to obtain flow statistics (col. 6, lines 27-52, A data collector 52 can be 
disposed in the network in a path between the entities "A" and "B", such that the data collector 
52 monitors some of the packets that comprise a flow between "A" and "B ." As a single point 
monitor, the data collector has no concept that there are two ends communicating, and for flow 
statistic, col. 22, line58, to col. 23, line 9); and 
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aggregating the flow statistics to obtain a traffic profile of the network flows at the measurement 
point (col. 31, lines 7-40, DiffServ enabled networks classify packets into one of a small number 
of aggregated flows or "classes", based on bits set in the type of service (TOS) field of each 
packet's IP header. This is a quality of service technology for IP networking is designed to lower 
the statistical probability of packet loss of specific flows ). 

The reference Bullard, does not explicitly teach of network flow having invariant features. 
However, Bullard in col. 6, lines 27-53, teaches of data collector being modeled as a data 
collector develops a "connection oriented tracking", and the network can be modeled as pipes 
having two endpoints ", and later in col. 2, lines 38-44 (different protocol types), and in col. 6, 
lines 15-26, port information (For example, a switch may have a number of Ethernet ports and a 
host could be connected to one of the ports and in communication with one of the interfaces to 
transfer information over the network) which are invariant for the reason to facilitates the end 
communication and data collector being able to communicate between these end point entities 
and gather information for profiling. Therefore, it would have been obvious for one ordinary skill 
in the art at the time the invention was made to use invariant features for the reason to facilitate 
the end communication and data collector being able to communicate between these end point 
entities and gather profiling information. 

Per claims 2 and 12, The method as claimed in claim 1 wherein the step of aggregating is based 
on at least one of the invariant features (col. 15, lines 8-28, Recall that each equipment interface 
42a-42g is associated with an flow data collector. Thus, the combination of an equipment 



Application/Control Number: 09/855,809 Page 4 

Art Unit: 2127 

interface and a flow data collector support a particular device or technology and collects data 
from the particular device or technology using a pre-defined format, schedule and protocol 
specific to that device/technology). 

Per claims 3 and 13, the method as claimed in claim 2 wherein the at least one invariant feature 
is either a source endpoint or a destination endpoint and wherein the step of aggregating is based 
on distance of the measurement point From the endpoint (col. 7, lines 1-11, The data collector 52 
identifies a source and a destination of the traffic. That is, the data collector develops a 
"connection oriented tracking). 

Per claims 4 and 14, the method as claimed in claim 1 wherein the invariant features include 
source and destination endpoints (col. 7, lines 1-11, source and destination endpoint). 

Per claim 5, the method as claimed in claim 4 further comprising identifying typical traffic 
source and destination pairs for network flows that transit the measurement point based on the 
source and destination endpoints. The reference of Bullard teaches of pipes having two endpoints 
and in any network including typical network (col. 7, lines 1-11). 

Per claims 6 and 16, the method as claimed in claim 4 wherein the invariant features include 
protocol type (col. 2, lines 38-44, different protocol types). 
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Per claims 7 and 17, the method as claimed in claim 6 where the invariant features include port 
information (col. 6, lines 15-26, port information (For example, a switch may have a number of 
Ethernet ports and a host could be connected to one of the ports and in communication with one 
of the interfaces to transfer information over the network). 

Per claims 8 and 18, the method as claimed in claim 1 wherein the step of aggregating is based 
on temporal, static network and dynamic routing parameters (col. 6, lines 27-52, For a router, 
normally an address of the object that is connected to that interface might serve as an address. A 
switch has an IP address that can be used as the destination. The actual device that is connected 
to the switch or router can be used as an accountable object. Although the traffic is not destined 
for the router, the data collector can use those identifiers as keys to the endpoints "A", "B."). 

Per claims 9 and 19, the method as claimed in claim 1 further comprising identifying desired 
network flow characteristics based on dynamic routing and topology information (col. 21, lines 
26-36, how aggregation is used to provide the data to meet the needs of a specific application. 
The aggregation performed by the different levels can also be remotely and independently 
adjusted, as will now be described). 

Per claims 10 and 20, the method as claimed in claim 1 wherein the computer network is the 
Internet (col. 5, lines 18-39, Data is made available to the Internet service provider via the data 
distribution layer (FIG. 2) so that the Internet service provider can analyze data in order to 
differentiate service offerings to different users). 
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Per claim 21, the method as claimed in claim 3 wherein level of route aggregation is a measure 
of the distance (col. 7, lines 1-1 1, the data collector 52 identifies a source and a destination of the 
traffic. That is, the data collector develops a "connection oriented tracking"). 

Per claim 22, the method as claimed in claim 3 further comprising utilizing physical and logical 
router interfaces at a highest level of aggregation (col. 10, lines 27-42, a source and a destination 
identifier to the metric. In the example of a router link, the metrics that the router interface 
provides are in the form of "information in" and "information out" e.g., octets in, octets out, 
bytes in, bytes out datagrams in, datagrams out, faults in, faults out, and so forth). 

Per claim 23, the method as claimed in claim 3 wherein the distance is a logical distance with 
respect to forwarding topology (col. 7, lines 1-1 1, the data collector 52 identifies a source and a 
destination of the traffic. That is, the data collector develops a "connection oriented tracking"). 

Per claim 24, the system as claimed in claim 1 1 where the system is capable of adapting to 
system resources in a dynamic fashion by reassignment of system resources to deal with possible 
aggregation levels. The system of Bullard teaches of the limitation in Fig. 21 (FIG. 21 is a 
hierarchical representation of an aggregation adjustment scheme for adjusting the aggregation 
activity at the levels of the flow aggregation processor and the data collectors). 
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Conclusion 



4. The prior art made of record and not relied upon is considered pertinent to applicant's 



5. Any inquiry concerning this communication or earlier communications from the examiner 
should be directed to Majid A. Banankhah whose voice telephone number is (703) 308-6903. A 
voice mail service is also available at this number. 

All response sent to U.S. Mail should be mailed to: 
Commissioner of Patent and Trademarks 
Washington, D.C. 20231 

Hand-delivered responses should be brought to Crystal Park Two, 2021 Crystal 
Drive, Arlington. VA, Sixth Floor (Receptionist). All hand-delivered responses will be 
handled and entered by the docketing personnel. Please do not hand deliver responses to the 
Examiner. 

All Formal or Official Faxes must be signed and sent to either (703) 308-9051 or 
(703) 308-9052. Official faxes will be handled and entered by the docketing personnel. The date 
of entry will correspond to the actual FAX reception date unless that date is a Saturday, Sunday, 
or a Federal Holiday within the District of Columbia, in which case the official date of receipt 
will be the next business day. The application file will be promptly forwarded to the Examiner 
unless the application file must be sent to another area of the office, e.g., Finance Division for 
fee charging, etc. 

Any inquiry of a general nature or relating to the status of this application should be 
directed to the Group receptionist whose telephone number is (703) 305-9600. 

Majid Banankhah 
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